50 Linux Commands Every DevOps Engineer Must Know

Why Linux Commands Still Matter in 2026

Cloud, containers, Kubernetes - the stack keeps changing, but the shell stays the same. Whether you are debugging a crashed pod, tailing logs at 2 AM, or writing a CI script, you are running Linux commands. Knowing them well is the difference between a 5-minute fix and a 2-hour search.

This guide covers 50 commands grouped by what you will actually use them for, with the flags that matter in a real job. If you want to practice these hands-on, ShellGenius Linux Labs has 50 challenges built around exactly these tools.

---

File Operations

ls - list directory contents.

ls -lah          # long format, human-readable sizes, hidden files
ls -lt           # sort by modification time, newest first
ls -lS           # sort by size, largest first

find - search the filesystem. One of the most versatile tools available.

find /var/log -name "*.log" -mtime -1      # logs modified in last 24h
find /home -type f -size +100M             # files larger than 100 MB
find /tmp -type f -name "*.tmp" -delete    # delete all .tmp files
find . -perm /o+w                          # world-writable files (security audit)

cp, mv, rm - copy, move, delete.

cp -a /src /dst           # archive mode: preserves permissions, timestamps, symlinks
mv -v file.txt ../other/  # verbose rename/move
rm -rf /tmp/scratch       # force-remove recursively (be careful)

chmod and chown - permissions and ownership.

chmod 644 /etc/nginx/nginx.conf    # rw-r--r--
chmod -R 755 /var/www/html         # rwxr-xr-x recursively
chown -R www-data:www-data /srv/   # set owner and group
chown :deploy /opt/app             # change group only

ln - create links.

ln -s /etc/nginx/sites-available/app /etc/nginx/sites-enabled/app   # symlink
ln /data/db.sqlite /backup/db.sqlite                                  # hard link

---

Process Management

ps - snapshot of running processes.

ps aux                   # all processes, all users, BSD style
ps -ef                   # all processes, full format, POSIX style
ps aux --sort=-%mem      # sorted by memory usage
ps -u nginx              # processes owned by the nginx user

top / htop - interactive process viewer. top is universal; htop is more readable.

top -b -n 1              # batch mode, single snapshot (good for scripts)
top -p 1234,5678         # watch specific PIDs only

kill and killall

kill -9 1234       # SIGKILL - force terminate immediately (no cleanup)
kill -15 1234      # SIGTERM - graceful shutdown (default)
kill -HUP 1234     # SIGHUP - reload config without restarting (nginx, sshd)
killall nginx      # kill all processes named nginx

nice and renice - CPU scheduling priority (-20 highest, 19 lowest).

nice -n 10 ./backup.sh        # start backup at low priority
renice +15 -p 1234            # lower priority of running process

nohup and jobs - background and session-independent processes.

nohup ./long-job.sh > job.log 2>&1 &    # run immune to hangup, background it
jobs -l                                   # list background jobs with PID
bg %1                                     # resume job 1 in background
fg %1                                     # bring job 1 to foreground

---

Networking

ss - socket statistics. Replaces netstat on modern systems.

ss -tlnp            # TCP listening ports with process names
ss -s               # summary of socket counts
ss -tulnp           # TCP and UDP listening, numeric, with processes

curl - HTTP client. Essential for API testing and health checks.

curl -I https://shellgenius.com                    # headers only
curl -X POST -H "Content-Type: application/json"   -d '{"key":"val"}' https://api.example.com/endpoint
curl -o /dev/null -s -w "%{http_code}" https://example.com   # status code only
curl --retry 3 --retry-delay 2 https://flaky.api/            # auto-retry

dig - DNS lookup. More reliable than nslookup for scripting.

dig shellgenius.com A          # A record (IPv4)
dig @8.8.8.8 example.com MX   # query Google's DNS for mail records
dig shellgenius.com +short     # just the answer

ssh - remote shell.

ssh -i ~/.ssh/deploy_key user@host
ssh -L 8080:localhost:3000 user@remote    # local port forward
ssh -N -D 1080 user@host                  # SOCKS proxy

rsync - efficient file transfer over SSH.

rsync -avz --progress /local/ user@host:/remote/   # sync with compression
rsync -avz --delete /src/ /dst/                    # mirror, delete extras

---

Disk and Storage

df - disk free space.

df -h              # human-readable (GB, MB)
df -hT             # include filesystem type
df -i              # show inode usage instead of blocks

du - disk usage of files and directories.

du -sh /var/log    # total size of /var/log
du -h --max-depth=1 /var    # top-level breakdown under /var
du -sh * | sort -hr | head   # largest items in current dir

lsblk - list block devices.

lsblk -f           # with filesystem types and UUIDs
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT

mount - mount filesystems.

mount | grep "^/dev"       # show mounted real devices
mount -o remount,rw /      # remount root as read-write
mount UUID=abc123 /mnt/data

---

Text Processing

These commands are the foundation of shell scripting and log analysis.

grep - search text with patterns.

grep -r "error" /var/log/         # recursive search
grep -i "failed" auth.log         # case-insensitive
grep -v "DEBUG" app.log           # exclude matches
grep -E "WARN|ERROR" app.log      # extended regex (multiple patterns)
grep -c "404" access.log          # count of matching lines
grep -n "timeout" nginx.conf      # show line numbers

awk - field-based text processing.

awk '{print $1, $7}' access.log          # print columns 1 and 7
awk -F: '{print $1}' /etc/passwd         # colon delimiter, first field
awk 'NR==5, NR==10' file.txt             # lines 5 to 10
awk '$5 > 100 {print $0}' data.txt       # filter rows where column 5 > 100

sed - stream editor.

sed 's/old/new/g' file.txt               # replace all occurrences
sed -i 's/localhost/127.0.0.1/g' app.conf  # in-place edit
sed -n '10,20p' file.txt                 # print lines 10-20
sed '/^#/d' config.conf                  # delete comment lines

cut, sort, uniq - slice, sort, deduplicate.

cut -d',' -f1,3 data.csv              # CSV columns 1 and 3
sort -k3 -n data.txt                  # sort numerically by column 3
sort -u file.txt                      # sort and remove duplicates
uniq -c sorted.txt | sort -rn         # count unique lines, most frequent first

tail and head - reading log files.

tail -f /var/log/syslog          # follow, real-time
tail -n 100 app.log              # last 100 lines
head -n 20 /etc/hosts            # first 20 lines

xargs - pass output as arguments to another command.

find . -name "*.bak" | xargs rm -f
cat hosts.txt | xargs -I{} ssh {} "uptime"

---

System Information

uname - kernel and OS info.

uname -r      # kernel release
uname -a      # all info (arch, hostname, kernel)

uptime - how long the system has been running and load average.

uptime
# output: 14:32:01 up 12 days, 3:04, 2 users, load average: 0.15, 0.22, 0.19

The three numbers are 1-minute, 5-minute, and 15-minute load averages. On a 4-core machine, a sustained load above 4.0 means the CPUs are saturated.

free - memory usage.

free -h       # human-readable, shows used/free/available

vmstat - virtual memory, CPU, I/O stats.

vmstat 1 5    # report every 1 second, 5 times

dmesg - kernel ring buffer. First place to look after hardware errors or OOM events.

dmesg -T | tail -50       # last 50 messages with timestamps
dmesg -T | grep -i "oom"  # out-of-memory kills
dmesg -T | grep -i "error"

---

Practice These in Real Labs

Reading about commands is useful. Running them under pressure is how you actually learn them. ShellGenius has 50 Linux challenges that put these tools in realistic scenarios - process forensics, disk crisis, log investigation, AppArmor auditing, and more. The warmup track covers 85+ commands in a guided, hands-on format if you are just starting out.